Compensating Controls for a Legacy System?
An organization disabled unneeded services and placed a firewall in front of a business-critical legacy system. Which of the following best describes the actions taken by the organization?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests whether you can identify compensating controls implemented around an unpatchable legacy system, and the trap is choosing segmentation merely because a firewall sits in front of the host.
Disabling unneeded services and placing a firewall in front of a business-critical legacy system are compensating controls: alternative safeguards used when the system cannot be patched or hardened normally. This page confirms D is the best answer over segmentation, exception, and risk transfer, with expert analysis and community consensus.
The most common wrong answer is B (segmentation), because a firewall in front of a legacy system sounds like network isolation; however, the scenario emphasizes mitigating the legacy system's unpatched risk with alternative safeguards, not dividing the network into segments.
Community Discussion (11 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The organization is dealing with a business-critical legacy system that likely cannot be patched, upgraded, or hardened to current standards, so it applies alternative safeguards: disabling unneeded services to shrink the attack surface and placing a firewall in front of it to filter traffic. These are classic compensating controls, because they compensate for the missing primary controls (vendor patches, modern OS hardening) without changing the legacy system itself. CompTIA SY0-701 defines compensating controls as alternate controls deployed when the primary control is infeasible, which matches the scenario exactly. The firewall and service-disablement are not the ideal long-term fix, but they reduce risk to an acceptable level while the legacy system remains in production.Why the Other Options Are Wrong
Segmentation (B) would mean dividing the network into isolated zones and controlling traffic between them; a firewall can support segmentation, but the question's focus is on compensating for the legacy host's weaknesses, not on creating network segments. An exception (A) is a documented policy deviation, such as allowing a legacy system to bypass a patching standard, but the organization here is adding controls rather than granting an exemption. Risk transfer (C) means shifting financial impact to a third party, typically through insurance or outsourcing, and nothing in the scenario indicates a third party accepted the risk. Compensating controls (D) is the only option that describes both actions as risk-mitigation alternatives for an unsupported system.Community Comment Notes
Most learners converged on D, with Th3irdEye noting that the word "legacy" should signal a compensating control, and Etc_Shadow28000 explaining that disabling services and adding a firewall mitigate risks when primary controls are not feasible. dbrowndiver similarly described the actions as alternative controls that enhance security without changing the legacy system. CyberPark17 dissented, arguing B is the action taken while D is the result, but that reasoning conflates a possible implementation detail with the best description of the organization's intent. EngAbood's short "Legacy = Compensating" summarizes the community's practical heuristic. The consensus, supported by CompTIA's control taxonomy, is D.Official Reference
Exam Strategy
When a scenario mentions a legacy, unsupported, or unpatchable system and then lists added safeguards, think compensating controls rather than segmentation. Ask whether the organization is dividing the network (segmentation) or working around a primary control that cannot be applied (compensation).
Frequently Asked Questions
Why is segmentation not the best answer when a firewall is placed in front of a legacy system?
The firewall may isolate traffic, but the scenario's intent is to compensate for the legacy system's unpatched weaknesses with alternative controls, not to create network segments (B).
What makes disabling unneeded services a compensating control rather than standard hardening?
On a legacy system that cannot be patched or upgraded, disabling services is an alternative safeguard that reduces attack surface where the primary control—vendor-supported hardening—is not feasible.
Related Analysis
Practice All SY0-701 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SY0-701 Practice Test →